Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I mean, why not tell everyone our password hashes?

theobsidiantower.com

Post reply on HN
Print view View original

101–110 of 167 posts

Re: I mean, why not tell everyone our password hashes?

#101

Post by cobythedog »

developer2 wrote: post #18

One reason: you'd be surprised how many companies allow entering the hash as an alternative password to login to customers' accounts in production. Lazy method for customer support teams who don't have support tools to access customer information. Also frequently done to allow developers to debug problems on a customer's account when a bug cannot be reproduced elsewhere. If such a company's database of hashed passwor…

Even some software do that. You can connect to a SAS server using your hashed password, which is stored in an XML config file on your computer when using EG.

Re: I mean, why not tell everyone our password hashes?

#102

Post by BenjiWiebe »

LinuxBender wrote: post #51
schoen wrote: post #41

I was kind of disturbed that GitHub publishes every user's public key. https://developer.github.com/v3/users/keys/ This is a different situation and public keys are not directly analogous to password hashes: there isn't a reliable way of cracking public keys in the same sense that there's a semi-reliable way of cracking hashes. But it was still strange and uncomfortable to me that they would reveal this "target" (and…

You can have a GitHub specific ssh key. ssh-keygen -q -t rsa -b 4096 -N "passphrase" -C "mygithub@someaddress.org" -f ${HOME}/.ssh/.ghub then in your ${HOME}/.ssh/config IdentitiesOnly yes Host github.com Hostname ssh.github.com Port 443 User git IdentityFile /home/username/.ssh/.ghub ForwardAgent no Not that it matters in this case, just sayin'.

In fact, I have a machine specific GitHub specific key.

Re: I mean, why not tell everyone our password hashes?

#103

Post by TheCoelacanth »

Retric wrote: post #100
throwaway76543 wrote: post #94

Earlier quoted context omitted.

Yes, that is incorrect. A GPU accelerated tool like HashCat can crack that password with a fairly small hardware footprint. Here's an article involving a 25 machine cluster which would reverse your hash in about 12 minutes -- regardless of your password features. http://www.zdnet.com/article/25-gpus-devour-password-hashes-... This isn't nation-state level cost. Individuals could afford this level of hardware. Many in…

Uhh, 14 characters long. Call it even ~30^14 / 348 billion per second = 1,374,416,379 seconds. So, they can break passwords with some pattern to them, but not really brute force em.

That's only 43 years and it was only 25 GPUs. Bump that up to 12000 GPUs and you could do it in about a month.

It's also an unsalted hash, so you could brute force an unlimited number of passwords at the same time without additional resources. Someone with a budget of a few million dollars could break every password in the world in a month.

So in other words, definitely don't publicize unsalted MD5 hashes of your passwords.

Re: I mean, why not tell everyone our password hashes?

#104

Post by irundebian »

LinuxBender wrote: post #51
schoen wrote: post #41

I was kind of disturbed that GitHub publishes every user's public key. https://developer.github.com/v3/users/keys/ This is a different situation and public keys are not directly analogous to password hashes: there isn't a reliable way of cracking public keys in the same sense that there's a semi-reliable way of cracking hashes. But it was still strange and uncomfortable to me that they would reveal this "target" (and…

You can have a GitHub specific ssh key. ssh-keygen -q -t rsa -b 4096 -N "passphrase" -C "mygithub@someaddress.org" -f ${HOME}/.ssh/.ghub then in your ${HOME}/.ssh/config IdentitiesOnly yes Host github.com Hostname ssh.github.com Port 443 User git IdentityFile /home/username/.ssh/.ghub ForwardAgent no Not that it matters in this case, just sayin'.

2048 is enough.

Re: I mean, why not tell everyone our password hashes?

#105

Post by toss1829654 »

cestith wrote: post #37
developer2 wrote: post #18

One reason: you'd be surprised how many companies allow entering the hash as an alternative password to login to customers' accounts in production. Lazy method for customer support teams who don't have support tools to access customer information. Also frequently done to allow developers to debug problems on a customer's account when a bug cannot be reproduced elsewhere. If such a company's database of hashed passwor…

What would it take to get you to name and shame? That whistle pretty likely needs to be blown on the one that didn't agree to abandon such a policy.

Microsoft Windows does this. NT hashes are password equivalent:

https://en.wikipedia.org/wiki/Pass_the_hash

Re: I mean, why not tell everyone our password hashes?

#106

Post by ams6110 »

developer2 wrote: post #91
cestith wrote: post #37

Earlier quoted context omitted.

What would it take to get you to name and shame? That whistle pretty likely needs to be blown on the one that didn't agree to abandon such a policy.

Small private company, nobody's ever heard of it. There are a lot of shady ones out there.

Agree. MANY small development shops will build these kinds of backdoors into systems because they don't have the skill or the resources to build proper customer support features.

Re: I mean, why not tell everyone our password hashes?

#107

Post by throwaway76543 »

Retric wrote: post #100
throwaway76543 wrote: post #94

Earlier quoted context omitted.

Yes, that is incorrect. A GPU accelerated tool like HashCat can crack that password with a fairly small hardware footprint. Here's an article involving a 25 machine cluster which would reverse your hash in about 12 minutes -- regardless of your password features. http://www.zdnet.com/article/25-gpus-devour-password-hashes-... This isn't nation-state level cost. Individuals could afford this level of hardware. Many in…

Uhh, 14 characters long. Call it even ~30^14 / 348 billion per second = 1,374,416,379 seconds. So, they can break passwords with some pattern to them, but not really brute force em.

Keep in mind article is from 5 years ago.

Re: I mean, why not tell everyone our password hashes?

#108

Post by LinuxBender »

irundebian wrote: post #104
LinuxBender wrote: post #51

Earlier quoted context omitted.

You can have a GitHub specific ssh key. ssh-keygen -q -t rsa -b 4096 -N "passphrase" -C "mygithub@someaddress.org" -f ${HOME}/.ssh/.ghub then in your ${HOME}/.ssh/config IdentitiesOnly yes Host github.com Hostname ssh.github.com Port 443 User git IdentityFile /home/username/.ssh/.ghub ForwardAgent no Not that it matters in this case, just sayin'.

2048 is enough.

I agree. I used 4096 in the example just in case my great grandkids find this post. They will have Quantum implants.

Re: I mean, why not tell everyone our password hashes?

#110

Post by nhumrich »

seiferteric wrote: post #99
throwaway76543 wrote: post #94

Earlier quoted context omitted.

Yes, that is incorrect. A GPU accelerated tool like HashCat can crack that password with a fairly small hardware footprint. Here's an article involving a 25 machine cluster which would reverse your hash in about 12 minutes -- regardless of your password features. http://www.zdnet.com/article/25-gpus-devour-password-hashes-... This isn't nation-state level cost. Individuals could afford this level of hardware. Many in…

Don't forget spinning up an AWS cluster for 12 mins would not cost too much.

Well, you would pay for the full hour regardless of how long the machines were up. GCP would give you too the minute pricing however. But your right, even a full hour is really cheap
Post reply on HN